Subprocessor Register
Named Subprocessors and What Each One Handles
| Subprocessor | Purpose | Data Categories | Region |
|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | Cloud hosting and infrastructure for the Aurora Command website, application, and stored Customer Data, including per-tenant network and database isolation. | All Customer Data and Customer Personal Data hosted in the platform. | United States (AWS us-west-2) |
| Amazon Web Services, Inc. (Amazon SES) | Transactional email delivery for account, billing, and product notifications. | Business contact and account data included in outbound email. | United States (AWS SES, default region us-east-1 in platform configuration) |
| Stripe, Inc. | Payment processing for self-service subscriptions. | Billing contact details and payment-method tokens. Aurora does not store full card numbers. | Not yet published |
| OpenAI | AI model provider for Aurora Copilot and AI-assisted drafting features, when Borealis provides the model workflow. | Prompts, retrieved context, attachments, and generated output submitted to AI-assisted features. | Not yet published |
| Anthropic | AI model provider for Aurora Copilot and AI-assisted drafting features, when Borealis provides the model workflow. | Prompts, retrieved context, attachments, and generated output submitted to AI-assisted features. | Not yet published |
| Google LLC (Google Analytics, incl. Google Tag Manager) | Public marketing-site analytics. Loads only after analytics consent is granted and is not loaded on sensitive routes. | Device, browser, and usage data from marketing-page visitors. | Not yet published |
| Microsoft Corporation (Microsoft Clarity) | Public marketing-site session analytics. Loads only after analytics consent is granted and is not loaded on sensitive routes. | Device, browser, and usage data from marketing-page visitors. | Not yet published |
| PostHog, Inc. | Product analytics and session replay across the website and authenticated workspace. Not loaded on sensitive routes; password fields are masked in replay. | Usage, device, and session-interaction data. | United States (PostHog US Cloud, per the us.i.posthog.com / us-assets.i.posthog.com endpoints enforced in the site's content security policy) |
| Functional Software, Inc. (Sentry) | Error monitoring for the website and product (error messages, stack traces, and request metadata, with sensitive values redacted where feasible). | Technical diagnostic data. Sensitive form values are not intentionally captured. | Not yet published |
| Telnyx LLC | Voice call and messaging infrastructure supporting Aurora Command's voice-based workflows and outbound business communications. | Call metadata and, where used within voice workflows, call content. | Not yet published |
| Reb2B | Marketing attribution technology on public marketing pages. Loads only after marketing consent is granted. | Usage and device data tied to marketing attribution. | Not yet published |
Each row is sourced from a specific document or configuration file in the Aurora Command codebase, listed alongside the row it supports on request. Fields marked Not yet published are not established by that evidence today; they are tracked as an internal follow-up rather than estimated.
How Aurora Tells Customers About Subprocessor Changes
Borealis publishes the current subprocessor list on this page (the Subprocessor Register contemplated by DPA Schedule 3 and Schedule 4). Notice of an update may be given by posting this Register, by email to Customer's designated contact, or both, at Borealis's election.
The DPA does not commit to a fixed number of advance-notice days. Unless a different period is expressly stated in a signed agreement or required by law, Borealis may update this Register on a prospective or contemporaneous basis with the change.
Under DPA §8.3, a customer that reasonably objects to a new subprocessor on documented grounds tied to applicable data protection law, and cannot resolve the issue with Borealis in good faith, may stop using the affected feature or terminate the affected Services before the new subprocessor begins processing Customer Personal Data for that feature.
Customers are responsible for keeping their privacy, legal, or procurement contact current if they want courtesy notices or access invitations in addition to this published Register.
Full text: Data Processing Addendum, Section 8 and Schedules 3-4.
Related Trust Resources
See how Aurora classifies, retains, and secures each data category in the data-handling matrix, or review the security one-pager and assurance roadmap.